Memory Exhaustion Vulnerability in OpenTelemetry eBPF Instrumentation by OpenTelemetry
CVE-2026-45682

5.1MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-ebpf-instrumentation
Vendor
CVE Published:
2 June 2026

What is CVE-2026-45682?

The OpenTelemetry eBPF Instrumentation prior to version 0.9.0 features a flawed CappedConcurrentHashMap that fails to remove keys from its insertion-order queue even when entries have been deleted. This flaw can lead to significant memory consumption as the queue grows indefinitely during long-running processes with frequent connection churn. As a result, the JVM may exhaust its heap memory. The issue has been addressed and resolved in version 0.9.0, and users are encouraged to update to this version to mitigate the risks associated with this vulnerability.

Affected Version(s)

opentelemetry-ebpf-instrumentation < 0.9.0

References

https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-ebpf-inst...
x_refsource_MISC

CVSS V3.1

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.